When an application escapes ASCII single quote characters "'" by coverting the character to the "\'" string is unsafe when operating in multibyte encodings (e.g., SJIS, BIG5, GBK, GB18030, UHC) that allow 0x5c (ASCII code for backslash) as the trailing byte of a multibyte character [CVE-2006-2314]. A remote user may be able to exploit an application that uses this conversion method to inject SQL commands.

The specific impact depends on the applications that process the user-supplied input.

The vendor's technical description of the vulnerability is available at:

http://www.postgresql.org/docs/techdocs.50

Impact:
A remote user may be able to execute SQL commands on the underlying database. The specific impact depends on the application that accepts user-supplied input.

Solution:
The vendor has issued a fixed version (8.1.4), available at: